8508a72c29c7fb3cb207df655a85a2aac8746839ff4810020739099941ec9967

Analysis

max time kernel
152s
max time network
139s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
21-05-2024 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IPTV管理.apk
Size

4.1MB
MD5

177534929eac6bf68f92138322b29992
SHA1

c335f1f15d515b9028146b8a8a78958844ec7b53
SHA256

8508a72c29c7fb3cb207df655a85a2aac8746839ff4810020739099941ec9967
SHA512

885eba5b50109418518594bda208308ac783d9b223efb136e85c6813994c4dc54e1613d8968f49f9ca0fb22e47956f873c4a37fc07a5baeebd31c78c7d05c22d
SSDEEP

98304:eQwKvotyQeRD/Gd+DOkheMUblA3xT0sx495Ab1qep2jfrREH:/eyJKkheMWlqj49561qOH

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	cn.tldati.app

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	cn.tldati.app

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	cn.tldati.app

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	cn.tldati.app

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	223.5.5.5

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cn.tldati.app

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cn.tldati.app

cn.tldati.app
1⤵
- Checks CPU information
- Checks memory information
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4307

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/cn.tldati.app/app_webview__ym/Cookies

Filesize
24KB

MD5
3e37fbe4bea382c16f256cc9653cde4f

SHA1
c924f3331904f2c8952f674d2e7894488963ca3d

SHA256
4c121f4f97e7c7d006abfede9a798eebe6de1e4c5ba02b5b8b1a24fea7ec871c

SHA512
6fe80d29e925a86e5515a256a7ad29f2e6ef0fbe165efe0170c0b025854139283dd025511fbd2a467fb5f02305a0a99d9026a900d2975f6454ee47c6cc5e8958

Download Submit
/data/data/cn.tldati.app/app_webview__ym/Cookies-journal

Filesize
512B

MD5
d5f499ff9ff512258321dd86c4f488d1

SHA1
7115930ba6b0884075b5e29e025dfa880c5c9249

SHA256
83e8409e3174c1d8444e015501beb622e31101f4cf35589cec720d2e813a8d8e

SHA512
b46f05f6cf9f901ebf3f12699625fc4d205b62c714d8b9341b7ead3d0f78c64d984a9fe5bea024381eda5f2923d78bffd1eebb726ea0593e97b57153c46b110a

Download Submit
/data/data/cn.tldati.app/app_webview__ym/Cookies-journal

Filesize
8KB

MD5
95199dbb5209f472e65979075972a7d8

SHA1
7bae4de0156f9078ef5a635edc95c065b8304a5d

SHA256
e4bc35aa2d04be2113c7cc69899a2e9df54ade2af7b58d0cc3247c15ccd6e686

SHA512
1d90fa05da07e6a654eab493b8809f67ed8c3516aaa308b1f7c9d5ab757041301ef24b9fdc57a8aebaaacf8234df7ed3abfc8e01771452b4b29e593cdb097bb7

Download Submit
/data/data/cn.tldati.app/app_webview__ym/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/data/cn.tldati.app/app_webview__ym/GPUCache/index-dir/temp-index

Filesize
48B

MD5
6dcf8579bf881bb4178f6491d5c8ed39

SHA1
82ce05c832be2188a2f540bc4a87cc58bb0cdc4d

SHA256
607069ad4b2e8a556ae6c8ef5223faf6bf593799148888a4e1c5b3ccd90b1916

SHA512
2ac0220d7edf6a09d3f21664fcee304f49c7eaf1116433b082377499513339d9485e8d791c794c5e2d8e7ba69489c83a62e67cc59127cf0d3ce08351778bb0f5

Download Submit
/data/data/cn.tldati.app/app_webview__ym/Web Data

Filesize
52KB

MD5
5168d8c4556ac22decc2362ce61ddafb

SHA1
664cb3c7b0b5b13c3b915c28354793bcc0afd408

SHA256
5057cf5dab27589d93f7d55ffa505ea8249c213b79fd8c85ac39423c135c5db6

SHA512
81cefa22b3b1d30acf590b44b97a47b68c265a15b3725ff348ac0256faae0aa76b6a9bedece897c912bbcc86623c3a20c193ff131d9a25d0ee8e315394ae332d

Download Submit
/data/data/cn.tldati.app/app_webview__ym/Web Data-journal

Filesize
512B

MD5
a3abdab5b10d975202f7bdf531fd611b

SHA1
870021751183754f4825e1a1dbb7ac91b9db13fb

SHA256
2c89e7ff5e3646a44c6fa7490218816c09c38a9dae219ea93b52becf377aa515

SHA512
4f9bbe27398ff6cc5ad4d300bc2b442df3c52be5b326ae9a29f88f34216fce59877656f7b02a9e9af3ab47f150a8e062aca15c0477bba6be3c5a96035388cf99

Download Submit
/data/data/cn.tldati.app/app_webview__ym/metrics_guid

Filesize
36B

MD5
862c48b12e844fc4d27d327365d299a7

SHA1
03e8ff768c52bb6faa92559f2af7316f8dea720b

SHA256
ebd4b2f0aef931e2bb9c5ccf94a0f338682cc42d0abb1a4f889b1a901ef0208f

SHA512
3e9221987ad16056449316de43d0a9fd0fb9c18ea8f3b630a4b83b46d3d08328aaa22afe2c62d6bd901adc901e29fa47aadba034a57dcb19d1686ec1b843d5a7

Download Submit
/data/data/cn.tldati.app/cache/webview__ym/org.chromium.android_webview/43d24e0db766f663_0

Filesize
126B

MD5
c7f10ea44fa9b8712bca421ab8ca8892

SHA1
b59523147ef67c0a71fa2063a184317face8e788

SHA256
c25b44e823f54cdba99a66b1d53f7415c5a46429eea0233e5a4d9c3b45ff5e84

SHA512
9b3de766ade9bc6c462210fff3c02fb53fbf224a5f4e78eb3abea6d3ae2b63c501a1d9fc0040849e7a47ad26ee4126a8dfb89c2dc8833700057dd0b0cd5d8743

Download Submit
/data/data/cn.tldati.app/cache/webview__ym/org.chromium.android_webview/index-dir/temp-index

Filesize
72B

MD5
beecc7fac1cfcb70b272c8375d993608

SHA1
c4d4018575696219277e936fe0ccb8b708712280

SHA256
6150b23c9522dc2b757b97b619a07ed493cadf19fdd82f2fdaf03fbf71daa551

SHA512
de4898a7e8c1fb94ec58d51ff3076ce9819e0d467a4738de5c4e7464aa62f68c23c508abefde92f6e75b688882794dd71876cf80e85c1d2cda2c6f7c8af9c809

Download Submit
/data/data/cn.tldati.app/cache/webview__ym/org.chromium.android_webview/index-dir/temp-index

Filesize
72B

MD5
93e5fa80863e8e934b1bfde7944da705

SHA1
21411f2772c1309d2af1d528e46cba6f67bf1478

SHA256
409828255d1c3fe8cd962c37050bba8a0a8923f3ef0418375df637138937df38

SHA512
e4ef45399fafc93c759ba3aa1420c25575e22e015673367569bdbd40d2862b82077212275600b09043e5f70cd17882ea21abe2b76ecc2862509aeeaeb1777cc9

Download Submit
/data/data/cn.tldati.app/cache/webview__ym/org.chromium.android_webview/index-dir/temp-index

Filesize
48B

MD5
bfbbd8fb6d1b584bccfc618e862e917e

SHA1
fcfb90acb4aab79f2e561f48df3f2a943f383181

SHA256
8949323aa94b32865a39cf08b9d4403df95357bec0960b004eaaf595eb56f2ce

SHA512
b7b1910109f23b1c6caf17155324fec0b5eba47fb1f58fec1befbd70b50734ba3197ba378326852c55d050c7971667532d1ae11fc239b3e567ea0d21ea84a65a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads